Reposting my GitHub comment: Thanks all for your comments. Regarding responsible disclosure, I'm aware of the concept. I did Google around and looked on the Wo

Reposting my GitHub comment: Thanks all for your comments. Regarding responsible disclosure, I'm aware of the concept. I did Google around and looked on the WooThemes site for a security notice address or similar and didn't find one. Even as a paying subscription customer, which I have happily been for the past year, the only way to get support is via their public forum. That being said, this is only "half" of the equation. I have already seen numerous hosting accounts compromised via a more malicious form of this attack which I have not published. In fact, finding a number of sites running WooThemes all compromised in the past 4 days via the contents of shortcode-generator/ lead me to take a quick look through the code to try to find the attack vector and I found this. Note that what I found isn't even really an exploit in its current form - just a bug which combined with a lot more work could be used to potentially cause harm. However, since I'm already seeing WooThemes-powered sites that have been compromised via the contents of shortcode-generator/, there is already a more serious problem in the wild. I would hope that WooThemes is aware of that - but again, they don't appear to have any security contact address, or any other transparency about the security of their products to be able to find out. With regards to security at WooThemes, I won't comment on their attack this week because clearly they are trying to recover from it. However, as one commenter in HackerNews posted, "Does this look like the authors even give a crap about security?" and with that I would tend to agree. For example, a few days prior to their site going down, WooThemes alerted their customers to update their themes for a security vulnerability... via a 5am tweet: https://twitter.com/#!/woothemes/status/192545687051829248 https://twitter.com/#!/woothemes/status/192545687051829248 "We found a minor vulnerability in the WooFramework, which we've just fixed. Please update to the latest version ASAP!" Not an email alert, not a blog post with details, just a tweet. Regarding the person who commented that this issue was already patched; that is incorrect. This has been tested against vanilla WooThemes running the latest version, which (according to the theme's built in updater) is 5.3.7. The WooThemes website only lists a changelog up to version 5.3.1, released almost 2 months ago: http://www.woothemes.com/updates/functions-changelog.txt http://www.woothemes.com/updates/functions-changelog.txt Additionally, even if the issue is patched, my link above still works - which means that the patch clearly isn't working or hasn't been applied to WooThemes own servers. The moral of this story is: WooThemes is a great company and makes a great product, but they have grown to the point where security needs to be a real concern. A proper channel to alert them of these issues, along with prompt and honest email notifications of updates to their customers (free and paid), and a publicly-accessible security/updates site (a la RedHat's RHSA system) are all long overdue. This isn't just a jab at WooThemes either - a review of almost any paid or free theme will surely come up with many issues like this. Perhaps the best solution is for WordPress to add a built in update notifier that can alert site admins when updates are available, but at this point anything would be helpful. Thanks again for the comments and thanks to those who posted simple patches to correct this small issue until an official update is released.